@openparachute/hub 0.7.3-rc.5 → 0.7.3-rc.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/hub",
-  "version": "0.7.3-rc.5",
+  "version": "0.7.3-rc.6",
   "description": "parachute — the local hub for the Parachute ecosystem (discovery, ports, lifecycle, soon OAuth).",
   "license": "AGPL-3.0",
   "publishConfig": {

package/src/__tests__/api-vault-caps.test.ts

@@ -0,0 +1,232 @@
+/**
+ * Tests for `/api/vault-caps*` (B5 admin visibility / D-slice).
+ * Covers:
+ *
+ *   - Auth boundary: GET + PUT require a bearer carrying `parachute:host:admin`.
+ *   - GET joins services.json vault names with persisted caps (uncapped =
+ *     null cap_bytes), ordered by name.
+ *   - PUT sets/updates a cap (upsert), validates positive cap, refuses a
+ *     vault not registered in services.json (400 vault_not_found).
+ *   - 405 on wrong methods.
+ */
+import type { Database } from "bun:sqlite";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { handleListVaultCaps, handleSetVaultCap } from "../api-vault-caps.ts";
+import { hubDbPath, openHubDb } from "../hub-db.ts";
+import { signAccessToken } from "../jwt-sign.ts";
+import { createUser } from "../users.ts";
+import { getVaultCapBytes, setVaultCap } from "../vault-caps.ts";
+
+const ISSUER = "https://hub.test";
+const HOST_ADMIN_SCOPE = "parachute:host:admin";
+
+interface Harness {
+  db: Database;
+  manifestPath: string;
+  cleanup: () => void;
+}
+
+function manifestWithVaults(...names: string[]): string {
+  const paths = names.map((n) => `/vault/${n}`);
+  return JSON.stringify({
+    services: [
+      { name: "parachute-vault", port: 4101, paths, health: "/health", version: "0.0.0-test" },
+    ],
+  });
+}
+
+function makeHarness(servicesJson?: string): Harness {
+  const dir = mkdtempSync(join(tmpdir(), "phub-api-vault-caps-"));
+  const db = openHubDb(hubDbPath(dir));
+  const manifestPath = join(dir, "services.json");
+  writeFileSync(manifestPath, servicesJson ?? manifestWithVaults("beta", "personal"));
+  return {
+    db,
+    manifestPath,
+    cleanup: () => {
+      db.close();
+      rmSync(dir, { recursive: true, force: true });
+    },
+  };
+}
+
+let harness: Harness;
+beforeEach(() => {
+  harness = makeHarness();
+});
+afterEach(() => {
+  harness.cleanup();
+});
+
+async function makeAdminBearer(scopes = [HOST_ADMIN_SCOPE]): Promise<string> {
+  const user = await createUser(harness.db, "operator", "any-password", {
+    allowMulti: true,
+    passwordChanged: true,
+  });
+  const minted = await signAccessToken(harness.db, {
+    sub: user.id,
+    scopes,
+    audience: "hub",
+    clientId: "parachute-hub-spa",
+    issuer: ISSUER,
+    ttlSeconds: 600,
+  });
+  return minted.token;
+}
+
+function req(path: string, init: RequestInit = {}): Request {
+  return new Request(`${ISSUER}${path}`, init);
+}
+
+function withBearer(path: string, bearer: string, init: RequestInit = {}): Request {
+  const headers = new Headers(init.headers ?? {});
+  headers.set("authorization", `Bearer ${bearer}`);
+  return new Request(`${ISSUER}${path}`, { ...init, headers });
+}
+
+function deps() {
+  return { db: harness.db, issuer: ISSUER, manifestPath: harness.manifestPath };
+}
+
+describe("handleListVaultCaps", () => {
+  test("401 with no Authorization header", async () => {
+    const res = await handleListVaultCaps(req("/api/vault-caps"), deps());
+    expect(res.status).toBe(401);
+  });
+
+  test("403 when bearer lacks parachute:host:admin", async () => {
+    const bearer = await makeAdminBearer(["other:scope"]);
+    const res = await handleListVaultCaps(withBearer("/api/vault-caps", bearer), deps());
+    expect(res.status).toBe(403);
+  });
+
+  test("405 on POST", async () => {
+    const bearer = await makeAdminBearer();
+    const res = await handleListVaultCaps(
+      withBearer("/api/vault-caps", bearer, { method: "POST" }),
+      deps(),
+    );
+    expect(res.status).toBe(405);
+  });
+
+  test("joins services.json vaults with caps, uncapped = null cap_bytes", async () => {
+    const bearer = await makeAdminBearer();
+    // Only "beta" has a persisted cap; "personal" stays uncapped.
+    setVaultCap(harness.db, "beta", 1024 * 1024 * 1024);
+    const res = await handleListVaultCaps(withBearer("/api/vault-caps", bearer), deps());
+    expect(res.status).toBe(200);
+    expect(res.headers.get("cache-control")).toBe("no-store");
+    const body = (await res.json()) as {
+      vault_caps: Array<{ vault_name: string; cap_bytes: number | null }>;
+    };
+    // Both vaults present, ordered by name (beta, personal).
+    expect(body.vault_caps.map((c) => c.vault_name)).toEqual(["beta", "personal"]);
+    const beta = body.vault_caps.find((c) => c.vault_name === "beta");
+    const personal = body.vault_caps.find((c) => c.vault_name === "personal");
+    expect(beta?.cap_bytes).toBe(1024 * 1024 * 1024);
+    expect(personal?.cap_bytes).toBeNull();
+  });
+});
+
+describe("handleSetVaultCap", () => {
+  test("401 with no Authorization header", async () => {
+    const res = await handleSetVaultCap(
+      req("/api/vault-caps/beta", {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ cap_bytes: 1000 }),
+      }),
+      "beta",
+      deps(),
+    );
+    expect(res.status).toBe(401);
+  });
+
+  test("403 when bearer lacks parachute:host:admin", async () => {
+    const bearer = await makeAdminBearer(["other:scope"]);
+    const res = await handleSetVaultCap(
+      withBearer("/api/vault-caps/beta", bearer, {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ cap_bytes: 1000 }),
+      }),
+      "beta",
+      deps(),
+    );
+    expect(res.status).toBe(403);
+  });
+
+  test("400 on a fractional (non-integer) cap", async () => {
+    const bearer = await makeAdminBearer();
+    const res = await handleSetVaultCap(
+      withBearer("/api/vault-caps/beta", bearer, {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ cap_bytes: 1.5 }),
+      }),
+      "beta",
+      deps(),
+    );
+    expect(res.status).toBe(400);
+  });
+
+  test("405 on GET", async () => {
+    const bearer = await makeAdminBearer();
+    const res = await handleSetVaultCap(withBearer("/api/vault-caps/beta", bearer), "beta", deps());
+    expect(res.status).toBe(405);
+  });
+
+  test("sets a cap on a registered vault and persists it (upsert)", async () => {
+    const bearer = await makeAdminBearer();
+    const res = await handleSetVaultCap(
+      withBearer("/api/vault-caps/beta", bearer, {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ cap_bytes: 2 * 1024 * 1024 * 1024 }),
+      }),
+      "beta",
+      deps(),
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { vault_cap: { cap_bytes: number } };
+    expect(body.vault_cap.cap_bytes).toBe(2 * 1024 * 1024 * 1024);
+    expect(getVaultCapBytes(harness.db, "beta")).toBe(2 * 1024 * 1024 * 1024);
+  });
+
+  test("400 vault_not_found for a vault not in services.json", async () => {
+    const bearer = await makeAdminBearer();
+    const res = await handleSetVaultCap(
+      withBearer("/api/vault-caps/ghost", bearer, {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ cap_bytes: 1000 }),
+      }),
+      "ghost",
+      deps(),
+    );
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { error: string };
+    expect(body.error).toBe("vault_not_found");
+    // Nothing persisted for the rejected name.
+    expect(getVaultCapBytes(harness.db, "ghost")).toBeNull();
+  });
+
+  test("400 on non-positive cap", async () => {
+    const bearer = await makeAdminBearer();
+    const res = await handleSetVaultCap(
+      withBearer("/api/vault-caps/beta", bearer, {
+        method: "PUT",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ cap_bytes: 0 }),
+      }),
+      "beta",
+      deps(),
+    );
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { error: string };
+    expect(body.error).toBe("invalid_request");
+  });
+});

package/src/api-vault-caps.ts

@@ -0,0 +1,206 @@
+/**
+ * `/api/vault-caps*` — admin visibility + edit for per-vault storage caps
+ * (DEMO-PREP-2026-06-25 Workstream B5 / D-slice).
+ *
+ * PR #686 shipped the `vault_caps` table + `setVaultCap`/`getVaultCapBytes`
+ * (provision-time persistence) and a separate Phase-2 PR reads + ENFORCES the
+ * cap at upload time. This file is the OPERATOR-FACING seam in between: the
+ * admin SPA needs to SEE who has what cap and EDIT a cap live in the demo.
+ *
+ * Surfaces:
+ *
+ *   GET /api/vault-caps          list every vault (from services.json) joined
+ *                                with its persisted cap (host:admin)
+ *   PUT /api/vault-caps/:name    set/update a vault's cap to N bytes (host:admin)
+ *
+ * The list is the JOIN of "what vaults exist" (services.json, the canonical
+ * vault-name source) and "what caps are persisted" (`vault_caps`). A vault
+ * with no cap row appears with `cap_bytes: null` (uncapped) — the same
+ * "uncapped = no row" contract the Phase-2 enforcement reader relies on.
+ *
+ * Wire shape is snake_case (matches `/api/users`, `/api/invites`). Auth: same
+ * `parachute:host:admin` Bearer gate as every other `/api/*` admin surface;
+ * the SPA mints it from the session cookie via `/admin/host-admin-token`.
+ *
+ * Scope discipline: PUT only sets a cap on a vault that is REGISTERED in
+ * services.json (rejects a stale / typo name with 400 `vault_not_found`) so an
+ * operator can't seed a cap row for a vault that doesn't exist. Additive only —
+ * this never changes the provision-time cap-persistence from #686; it's a
+ * read + targeted-edit layer on the same table.
+ */
+import type { Database } from "bun:sqlite";
+import { type AdminAuthError, adminAuthErrorResponse, requireScope } from "./admin-auth.ts";
+import { HOST_ADMIN_SCOPE } from "./admin-vaults.ts";
+import { SERVICES_MANIFEST_PATH } from "./config.ts";
+import { getVaultCap, setVaultCap } from "./vault-caps.ts";
+import { listVaultNamesFromPath } from "./vault-names.ts";
+
+export interface ApiVaultCapsDeps {
+  db: Database;
+  /** Hub origin — JWT `iss` validation. */
+  issuer: string;
+  /** Override services.json path. Defaults to `~/.parachute/services.json`. */
+  manifestPath?: string;
+}
+
+/**
+ * One row in the `GET /api/vault-caps` response: a vault name + its cap. A
+ * vault with no persisted cap carries `cap_bytes: null` (uncapped); `created_at`
+ * / `updated_at` are null too in that case.
+ */
+export interface VaultCapWireShape {
+  vault_name: string;
+  cap_bytes: number | null;
+  created_at: string | null;
+  updated_at: string | null;
+}
+
+function jsonError(status: number, error: string, description: string): Response {
+  return new Response(JSON.stringify({ error, error_description: description }), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+/**
+ * GET /api/vault-caps — every vault registered in services.json, joined with
+ * its persisted cap (null = uncapped). Ordered by vault name.
+ */
+export async function handleListVaultCaps(req: Request, deps: ApiVaultCapsDeps): Promise<Response> {
+  if (req.method !== "GET") {
+    return jsonError(405, "method_not_allowed", "use GET");
+  }
+  try {
+    await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.issuer);
+  } catch (err) {
+    return adminAuthErrorResponse(err as AdminAuthError);
+  }
+  const manifestPath = deps.manifestPath ?? SERVICES_MANIFEST_PATH;
+  const names = listVaultNamesFromPath(manifestPath);
+  const caps: VaultCapWireShape[] = names.map((vaultName) => {
+    const cap = getVaultCap(deps.db, vaultName);
+    return {
+      vault_name: vaultName,
+      cap_bytes: cap?.capBytes ?? null,
+      created_at: cap?.createdAt ?? null,
+      updated_at: cap?.updatedAt ?? null,
+    };
+  });
+  return new Response(JSON.stringify({ vault_caps: caps }), {
+    status: 200,
+    headers: { "content-type": "application/json", "cache-control": "no-store" },
+  });
+}
+
+interface SetCapBody {
+  cap_bytes: number;
+}
+
+interface ParseErr {
+  ok: false;
+  status: number;
+  error: string;
+  description: string;
+}
+
+async function parseSetCapBody(req: Request): Promise<{ ok: true; body: SetCapBody } | ParseErr> {
+  const ctype = req.headers.get("content-type") ?? "";
+  if (!ctype.toLowerCase().includes("application/json")) {
+    return {
+      ok: false,
+      status: 400,
+      error: "invalid_request",
+      description: "Content-Type must be application/json",
+    };
+  }
+  let raw: unknown;
+  try {
+    raw = await req.json();
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      ok: false,
+      status: 400,
+      error: "invalid_request",
+      description: `invalid JSON body: ${msg}`,
+    };
+  }
+  if (!raw || typeof raw !== "object") {
+    return {
+      ok: false,
+      status: 400,
+      error: "invalid_request",
+      description: "request body must be a JSON object",
+    };
+  }
+  const obj = raw as Record<string, unknown>;
+  const capBytes = obj.cap_bytes;
+  // Positive integer only — the table's CHECK (cap_bytes > 0) is the at-rest
+  // backstop; this is the edge validation so the operator gets a clean 400
+  // instead of a sqlite constraint error. A fractional byte count (which a byte
+  // count can never be) is rejected rather than silently floored downstream.
+  if (typeof capBytes !== "number" || !Number.isInteger(capBytes) || capBytes <= 0) {
+    return {
+      ok: false,
+      status: 400,
+      error: "invalid_request",
+      description: '"cap_bytes" must be a positive integer number of bytes',
+    };
+  }
+  return { ok: true, body: { cap_bytes: capBytes } };
+}
+
+/**
+ * PUT /api/vault-caps/:name — set or update a vault's storage cap.
+ *
+ * Order of checks (mirrors the /api/users handlers):
+ *
+ *   1. Method gate (405 on non-PUT).
+ *   2. Bearer carries `parachute:host:admin` (401 / 403 via `requireScope`).
+ *   3. Parse + validate body (400 on shape / non-positive cap).
+ *   4. Vault is registered in services.json (400 `vault_not_found`) — refuse
+ *      to seed a cap for a vault that doesn't exist.
+ *   5. `setVaultCap` (upsert) — overwrites the cap, bumps `updated_at`,
+ *      preserves the original `created_at`.
+ *
+ * Response on success: `200 { vault_cap: <wire shape> }`.
+ */
+export async function handleSetVaultCap(
+  req: Request,
+  vaultName: string,
+  deps: ApiVaultCapsDeps,
+): Promise<Response> {
+  if (req.method !== "PUT") {
+    return jsonError(405, "method_not_allowed", "use PUT");
+  }
+  try {
+    await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.issuer);
+  } catch (err) {
+    return adminAuthErrorResponse(err as AdminAuthError);
+  }
+  const parsed = await parseSetCapBody(req);
+  if (!parsed.ok) {
+    return jsonError(parsed.status, parsed.error, parsed.description);
+  }
+  const manifestPath = deps.manifestPath ?? SERVICES_MANIFEST_PATH;
+  const known = new Set(listVaultNamesFromPath(manifestPath));
+  if (!known.has(vaultName)) {
+    return jsonError(
+      400,
+      "vault_not_found",
+      `vault "${vaultName}" is not registered in services.json`,
+    );
+  }
+  const cap = setVaultCap(deps.db, vaultName, parsed.body.cap_bytes);
+  console.log(`vault cap set: vault=${vaultName} cap_bytes=${cap.capBytes}`);
+  const wire: VaultCapWireShape = {
+    vault_name: cap.vaultName,
+    cap_bytes: cap.capBytes,
+    created_at: cap.createdAt,
+    updated_at: cap.updatedAt,
+  };
+  return new Response(JSON.stringify({ vault_cap: wire }), {
+    status: 200,
+    headers: { "content-type": "application/json", "cache-control": "no-store" },
+  });
+}

package/src/hub-server.ts

@@ -96,6 +96,8 @@
  *   /api/users/vaults             (GET)        → vault-name list for assigned-vault picker (host:admin)
  *   /api/users/<id>               (DELETE)     → hard-delete user + revoke tokens (host:admin)
  *   /api/users/<id>/reset-password (POST)      → admin-initiated password reset (host:admin)
+ *   /api/vault-caps               (GET)        → list vaults + persisted storage caps (host:admin)
+ *   /api/vault-caps/<name>        (PUT)        → set/update a vault's storage cap (host:admin)
  *   /login                        (GET + POST) → operator password login
  *   /login/2fa                    (POST)       → second-factor (TOTP/backup) step
  *                                                 (hub#473; reached after a correct
@@ -221,6 +223,7 @@ import {
   handleResetUserPassword,
   handleUpdateUserVaults,
 } from "./api-users.ts";
+import { handleListVaultCaps, handleSetVaultCap } from "./api-vault-caps.ts";
 import { gateUiAudience, resolveUiMount } from "./audience-gate.ts";
 import {
   CHROME_OPT_OUT_PREFIXES,
@@ -3351,6 +3354,30 @@ export function hubFetch(
         });
       }
 
+      // Per-vault storage caps (B5 admin visibility / D-slice). GET lists every
+      // vault from services.json joined with its persisted cap; PUT /:name
+      // sets/updates a cap. host:admin-gated, same gate flavor as /api/users.
+      if (pathname === "/api/vault-caps") {
+        if (!getDb) return dbNotConfigured();
+        return handleListVaultCaps(req, {
+          db: getDb(),
+          issuer: oauthDeps(req).issuer,
+          manifestPath,
+        });
+      }
+      if (pathname.startsWith("/api/vault-caps/")) {
+        if (!getDb) return dbNotConfigured();
+        const name = decodeURIComponent(pathname.slice("/api/vault-caps/".length));
+        if (!name || name.includes("/")) {
+          return new Response("not found", { status: 404 });
+        }
+        return handleSetVaultCap(req, name, {
+          db: getDb(),
+          issuer: oauthDeps(req).issuer,
+          manifestPath,
+        });
+      }
+
       // Canonical login/logout. The handlers themselves are unchanged from
       // when they lived at /admin/login + /admin/logout; the rename surfaced
       // via #231-followup so the URL reflects the surface's actual scope